Control Managed Package Connected App Permission Set from managed code

Question

I'd like to deploy a Canvas Connected App as part of a managed package and be able to dynamically assign users access to it via a Permission Set.

The Canvas App is using the Signed Request (Post) access method.

Under Manage Apps > Connected Apps > OAuth policies the Permitted Users have been set to "Admin approved users are pre-authorized". On the same screen a Permission Set has been added to the Connected App.

When the Permission Set and Canvas App are deployed as part of a managed package the Permitted Users resets to "All users may self-authorize" in the installing org.

After manually changing Permitted Users to "Admin approved users are pre-authorized" in the target org and attempting to add the managed permission set back to the Connected App I get the error:

Cannot Modify Managed Component
The component you are attempting to modify is part of a managed package, and cannot be modified. For more information, see Insufficient Privileges Errors.

Is this an explicit security restriction to ensure managed packages don't automatically grant users access?
I.e. Only an Admin in the local org can grant access to the App.

---

Based on App disappears from Permission Set included with package it appears to be a limitation of the packaging process rather than a specific security control.

From Special Behavior of Components in Packages

Permission Sets

You can include permission sets as components in a package, with the following permissions and access settings:

• Custom object permissions
  ...
• External data source access

Note
Assigned apps and tab settings are not included in permission set components.

So the assigned apps aren't carried over on the permission set currently.

The idea Maintain App and Tab settings for Permission Sets in Managed Packages would be worth promoting.

---

That leaves the question - How can a managed package control user access to the deployed Connected App?

Maybe if the installing Admin creates a new Permission Set and configures it against the Connected app as a manual post install step. Then the Id of the Permission Set that grants access could be configured into the managed package for creating the PermissionSetAssignment records.

Answer 1

While it is not possible to work with packaged connected app and packaged permission set, we may consider the following two options.

1. Use packaged connected app and unpackaged cloned permission set. It is possible to clone a packaged permission set or create unpackaged permission set via Apex Code like following

   PermissionSet ps = [SELECT Fields(Standard) FROM PermissionSet WHERE Name = 'PermissionName' AND NamespacePrefix = 'Namespace'];
   ps.clone(false);
   ps.Id = null;
   insert ps;
   

And you can use SetupEntityAccess to assign a permission set to a connected app.

Admin must manually set the packaged connected app settings to "Admin approved users are pre-authorized"

Then you can just save id or name of created unpackaged permission set and use it to grant access to your users by assigning it.

2. Use unpackaged connected app and unpackaged cloned permission set.

It is possible to create a button in setup configuration interface for admin to authorize an app in a simple one-click way.

This button click may deploy a new local unmanaged Connected App, make it preapproved and send its Consumer Key to you.

Then you can just save id or name of created unpackaged permission set and use it to grant access to your users by assigning it.